From 2978707a719deff8ad5b43de016eaa9ea16e0154 Mon Sep 17 00:00:00 2001 From: Paul R Kartchner Date: Wed, 5 Aug 2026 22:51:55 +0000 Subject: [PATCH] Disable signups; use crowdsec-bouncer@docker; drop redundant HTTP router signups_allowed was drifted to true on prod and is now false in both docker-compose.yml and data/config.json. config.json overrides the env var, so setting the compose value alone has no effect. The bouncer moved from @file to @docker because its API key is now a compose label sourced from .env, keeping config.yml secret-free. The vaultwarden-http router is removed as redundant: traefik.yml already redirects the http entrypoint to https globally (verified: http returns 301). --- docker-compose.yml | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 7c971b9..bf6bd0a 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -29,12 +29,6 @@ services: - "traefik.http.middlewares.vaultwarden-headers.headers.customResponseHeaders.X-Robots-Tag=noindex, nofollow" - "traefik.http.middlewares.vaultwarden-headers.headers.customResponseHeaders.X-Frame-Options=SAMEORIGIN" - # HTTP to HTTPS redirect - - "traefik.http.routers.vaultwarden-http.rule=Host(`${DOMAIN}`)" - - "traefik.http.routers.vaultwarden-http.entrypoints=http" - - "traefik.http.routers.vaultwarden-http.service=vaultwarden" - - "traefik.http.routers.vaultwarden-http.priority=100" - - "traefik.http.routers.vaultwarden-http.middlewares=redirect-to-https@docker" # Main HTTP/HTTPS router - "traefik.http.routers.vaultwarden.rule=Host(`${DOMAIN}`)" @@ -43,7 +37,7 @@ services: - "traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt" - "traefik.http.routers.vaultwarden.service=vaultwarden" - "traefik.http.services.vaultwarden.loadbalancer.server.port=80" - - "traefik.http.routers.vaultwarden.middlewares=geoblock@file,vaultwarden-headers,crowdsec-bouncer@file" + - "traefik.http.routers.vaultwarden.middlewares=geoblock@file,vaultwarden-headers,crowdsec-bouncer@docker" # WebSocket router (required for real-time sync) - "traefik.http.routers.vaultwarden-ws.rule=Host(`${DOMAIN}`) && Path(`/notifications/hub`)" @@ -52,7 +46,7 @@ services: - "traefik.http.routers.vaultwarden-ws.tls.certresolver=letsencrypt" - "traefik.http.routers.vaultwarden-ws.service=vaultwarden-ws" - "traefik.http.services.vaultwarden-ws.loadbalancer.server.port=3012" - - "traefik.http.routers.vaultwarden-ws.middlewares=geoblock@file,crowdsec-bouncer@file" + - "traefik.http.routers.vaultwarden-ws.middlewares=geoblock@file,crowdsec-bouncer@docker" # Admin panel router (restricted to internal IPs) - "traefik.http.routers.vaultwarden-admin.rule=Host(`${DOMAIN}`) && PathPrefix(`/admin`)" @@ -60,7 +54,7 @@ services: - "traefik.http.routers.vaultwarden-admin.tls=true" - "traefik.http.routers.vaultwarden-admin.tls.certresolver=letsencrypt" - "traefik.http.routers.vaultwarden-admin.service=vaultwarden" - - "traefik.http.routers.vaultwarden-admin.middlewares=internal-whitelist@file,crowdsec-bouncer@file" + - "traefik.http.routers.vaultwarden-admin.middlewares=internal-whitelist@file,crowdsec-bouncer@docker" networks: traefik: